Phorion

@PhorionTech

Phorion Technology focuses on building specialised macOS security products for use in the modern enterprise 🍎

phorion.io Joined October 2023

2 Following 181 Followers 40 Posts

Latest posts 5

Browser cache smuggling: tried and tested on Windows, viable on macOS?

Our latest research breaks down the technique, native OS defenses and how defenders can close the gaps.

phorion.io/blog/browser-c…

phorion.io Browser Cache Smuggling on macOS: Reproducing and Defending the Technique | Phorion Browser cache smuggling lets a website stage payloads on macOS for a ClickFix command to recover without another download. We examine Chrome, Firefox and Safari cache access, explain the limits of …

Phorion @PhorionTech Oct 30

Phorion has discovered a compromise of the official Claude Code for VS Code extension (2.1.313) on Open VSX.

Here is a breakdown of how the implant works, a bug in its macOS setup logic, and what to hunt for across your fleet. 🧵

Phorion @PhorionTech Oct 30

Phorion has detected a compromise of the official Claude Code VS Code extension. Distributed through Open VSX, Anthropic has also pulled the npm and VSCode versions.

The implant contains macOS, Linux and Windows code paths designed to establish persistent backdoored access.

phorion.io/blog/offical-c…

phorion.io Official Claude Code Extension Compromise: Security Advisory | Phorion Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up...

Phorion @PhorionTech Oct 20

An AI agent uploaded internal files to Pastebin. You can see what happened, but do you know why it did it?

Our latest post walks through how to use AI agent context during alert triage, even if your endpoint tooling doesn’t collect it for you.

phorion.io/blog/ai-agent-…

phorion.io Endpoint Security in the AI Age, Part II: Detection and Triage | Phorion This post looks at how agent attribution, collected session prompts and script content help analysts investigate AI-driven activity. We also cover tuning detections around common agent behaviour and …

Phorion @PhorionTech Oct 13

Part 1 of Phorion's Endpoint Security in the AI Age is here!

AI agents are changing endpoint security. Alert fidelity is dropping, and traditional tuning isn’t keeping up. A new era calls for a new approach to defending endpoints.

phorion.io/blog/ai-endpoi…

phorion.io Endpoint Security in the AI Age, Part I: Rethinking Detection Fidelity | Phorion AI is blurring the line between what users deliberately do and what software does on their behalf. As familiar patterns give way to unpredictable workflows, how do security teams tell normal activity...